In the analysis of the Zeus malware, which obfuscation technique was notably used to hide its configuration and steal credentials?

Encryption of configuration files

A malware sample uses a simple XOR loop to decode its payload. Which deobfuscation strategy would be most effective?

Use a hex editor to manually change bytes

Run the malware on a production server

Reimplement the XOR decoding routine in a script

During dynamic analysis, a malware sample calls GetTickCount at the start and end of a decoding loop, then compares the difference to a threshold. If the difference is too large, the sample exits. This is an example of which anti-analysis technique?

Anti-analysis via import table obfuscation

Anti-VM via CPU instruction detection

Anti-sandbox via user interaction detection

GIAC Reverse Engineering Malware

Domain 3Objective 2

Analyzing Obfuscated Malware GREM Practice Questions (Page 5)

Part of the Malware Patterns and Obfuscation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 21–25

21foundation · easy
In the analysis of the Zeus malware, which obfuscation technique was notably used to hide its configuration and steal credentials?
Select an answer first
22foundation · easy
A malware sample uses a simple XOR loop to decode its payload. Which deobfuscation strategy would be most effective?
Select an answer first
23application · medium
During dynamic analysis, a malware sample calls GetTickCount at the start and end of a decoding loop, then compares the difference to a threshold. If the difference is too large, the sample exits. This is an example of which anti-analysis technique?
Select an answer first
24application · medium
An analyst is reviewing a suspicious binary. The disassembly shows a large number of conditional jumps that all target the same address, and the code between them is never executed. This pattern is most indicative of which obfuscation technique?
Select an answer first
25foundation · easy
Malware uses the Windows API function IsDebuggerPresent to check if it is being debugged. What type of anti-analysis technique is this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Analyzing Obfuscated Malware GREM Practice Questions (Page 5)

Questions 21–25

In the analysis of the Zeus malware, which obfuscation technique was notably used to hide its configuration and steal credentials?

A malware sample uses a simple XOR loop to decode its payload. Which deobfuscation strategy would be most effective?

During dynamic analysis, a malware sample calls GetTickCount at the start and end of a decoding loop, then compares the difference to a threshold. If the difference is too large, the sample exits. This is an example of which anti-analysis technique?

An analyst is reviewing a suspicious binary. The disassembly shows a large number of conditional jumps that all target the same address, and the code between them is never executed. This pattern is most indicative of which obfuscation technique?

Malware uses the Windows API function IsDebuggerPresent to check if it is being debugged. What type of anti-analysis technique is this?

Keep studying — Malware Patterns and Obfuscation